fastrepl (>=0.0.21, <=0.0.25), funcflow (0.0.3) +2 more potentially affected by CVE-2026-59823 via litellm (0.8.6)

litellm PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl =0.0.21, =0.0.5, =0.0.9 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

aiconsole (>=0.2.0, <=0.2.7), fastrepl (>=0.0.19, <=0.0.20) potentially affected by CVE-2026-59823 via litellm (0.6.6)

litellm PYPI version 0.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - aiconsole =0.2.0, =0.0.19, =0.0.20 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

vimgpt (0.1.2) potentially affected by CVE-2026-59823 via litellm (0.1.618)

litellm PYPI version 0.1.618 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - vimgpt 0.1.2 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

PT-2026-105498

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

CVE-2026-92945: Improper Limitation of a Pathname to a Restricted Directory

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1769 more potentially affected by CVE-2026-92599 via joi (>=17.2.0, <=17.13.6)

joi NPM version =17.2.0, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-92599 Source advisory: SNYK:JS-JOI-19883907...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +55 more potentially affected by CVE-2026-68904 via node-opcua-client (>=2.10.0, <=2.169.0)

node-opcua-client NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves:...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), au.com.versent.jenkins.plugins:ignore-committer-strategy (>=29.v7c3891a_434c3, <=63.v7e87d06b_a_30c) +424 more potentially affected by CVE-2026-92129 via org.jenkins-ci.plugins:script-security (>=1.4, <=1415.v9a_f9b_3a_c253d)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =29.v7c3891a434c3, =2.33.0, =4.1.0.506.v619d63bec9d8, =1.0.5.0, =0.2, =198.vfe106798d1a6, =66.v12c841920f7d, =1.9.2-beta, =1.151.vbca71ddd0bcf, =1.29, =1.28.0, =61.v68bd7264b643, =73.ve2b957fc2921 and more Source cves: CVE-2026-92129 Sour...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), au.com.versent.jenkins.plugins:ignore-committer-strategy (>=29.v7c3891a_434c3, <=63.v7e87d06b_a_30c) +424 more potentially affected by CVE-2026-92128 via org.jenkins-ci.plugins:script-security (>=1.4, <=1415.v9a_f9b_3a_c253d)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =29.v7c3891a434c3, =2.33.0, =4.1.0.506.v619d63bec9d8, =1.0.5.0, =0.2, =198.vfe106798d1a6, =66.v12c841920f7d, =1.9.2-beta, =1.151.vbca71ddd0bcf, =1.29, =1.28.0, =61.v68bd7264b643, =73.ve2b957fc2921 and more Source cves: CVE-2026-92128 Sour...

@aliceo2/bookkeeping (>=1.19.0, <=1.20.0), @beyondnet/evolith-cli (>=1.2.0, <=1.3.2) +68 more potentially affected by CVE-2026-88932 via multer (>=2.2.0, <=2.3.0)

multer NPM version =2.2.0, =1.19.0, =1.2.0, =1.2.0, =2026.7.0, =5.7.5, =11.1.29-depup.0, =0.1.0, =0.1.0, =11.0.62, =1.2.34, =12.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-88932 Source advisory: SNYK:JS-MULTER-19785644...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1777 more potentially affected by CVE-2026-90771 via joi (>=17.1.1, <=17.13.7)

joi NPM version =17.1.1, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-90771 Source advisory: SNYK:JS-JOI-19778379...

@adatechnology/conversation-module (>=0.2.0, <=0.4.2), @adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35) +308 more potentially affected by CVE-2026-90771 via joi (>=18.0.0, <=18.2.8)

joi NPM version =18.0.0, =0.2.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =3.19.0 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-90771 Source advisory: OSV:GHSA-WR44-6HXH-3JWQ...

abscissa (>=0.0.1, <=0.0.4), aingle_zk (>=0.1.0, <=0.9.1) +329 more potentially affected by unknown CVE via clear_on_drop (>=0.2.3, <=0.2.5)

clearondrop CARGO version =0.2.3, =0.0.1, =0.1.0, =4.0.0, =0.12.0, =0.2.0, =1.0.0-pre.0, =0.1.0, =2.0.0, =0.1.0, =3.1.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0283...

PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks

Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its transitive dependencies later receives a vulnerability advisory. Existing vulnerability-detection work often...

confetti (>=4.0.0-rc.0, <=4.1.4) potentially affected by CVE-2026-61534 via yayson (>=4.1.0, <=4.2.0)

yayson NPM version =4.1.0, =4.0.0-rc.0, =4.1.4 Source cves: CVE-2026-61534 Source advisory: OSV:GHSA-325J-MG25-8Q58...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59148 via @mockoon/commons-server (>=9.0.0, <=9.6.1)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59148 Source advisory: OSV:GHSA-RQX4-3F6Q-3X2V...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59149 via @mockoon/commons-server (>=9.0.0, <=9.6.1)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59149 Source advisory: OSV:GHSA-8WQC-V2Q8-VFF2...

@frontmcp/adapters (>=1.0.4, <=1.5.0-rc.1), @frontmcp/plugin-skilled-openapi (>=0.0.1, <=1.5.0-rc.1) potentially affected by CVE-2026-59973 via mcp-from-openapi (>=2.3.0, <=2.4.0)

mcp-from-openapi NPM version =2.3.0, =1.0.4, =0.0.1, =1.5.0-rc.1 Source cves: CVE-2026-59973 Source advisory: OSV:GHSA-65H7-9WRW-629C...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.10), ai.covia:covia-discord (>=0.9.4, <=0.9.9) +9469 more potentially affected by CVE-2026-68497 via com.fasterxml.jackson.core:jackson-databind (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0, =2.0.0 and more Source cves: CVE-2026-68497 Source advisory: MEND:CVE-2026-68497...

@argos-ci/cli (>=5.0.0, <=5.1.0), @argos-ci/cypress (>=7.0.0, <=7.0.7) +2 more potentially affected by CVE-2026-59960 via @argos-ci/core (>=6.0.0, <=6.2.0)

@argos-ci/core NPM version =6.0.0, =5.0.0, =7.0.0, =7.0.0, =6.0.0, =6.0.8 Source cves: CVE-2026-59960 Source advisory: OSV:GHSA-4X45-GXVP-6283...